openaudit report: openaudit

2 high severity findings need attention

Grade B, score 85 of 100: the average of 9 category scores. The outer ring is one arc per category; the inner ring is the overall score.

Severity40 findings: 0Critical
2High
37Medium
1Low
0Info
Auditors50 in 17.4s: 22 passed4 failed0 errored24 skippedDetails

Most severe findings

Top 10 of 40

HighDetected a Generic API Key, potentially exposing access to various services and sensitive operations.apps/cli/dist/cli.js:4019:59 code.gitleaks/generic-api-keySecurity
HighDetected a Generic API Key, potentially exposing access to various services and sensitive operations.apps/cli/dist/cli.js:6743:6 code.gitleaks/generic-api-keySecurity
MediumUnescaped HTML renderingapps/site/src/scripts/catalogue.ts:50 code.security/xssSecurity
MediumTS2379: Argument of type '{ explicit: string | undefined; noConfig: boolean | undefined; target: string; cwd: string; }'…apps/cli/src/audit.ts:208:23 code.typecheck/type-errorReliability
MediumTS2375: Type '{ offline: boolean | undefined; browser: boolean | undefined; maxPages: number | undefined; agentic: boole…apps/cli/src/audit.ts:291:5 code.typecheck/type-errorReliability
MediumTS2375: Type '{ source: string; rules: readonly string[] | undefined; paths: readonly string[] | undefined; fingerprints…apps/cli/src/audit.ts:313:3 code.typecheck/type-errorReliability
MediumTS2451: Cannot redeclare block-scoped variable 'still'.apps/site/src/scripts/hero.ts:9:7 code.typecheck/type-errorReliability
MediumTS2451: Cannot redeclare block-scoped variable 'still'.apps/site/src/scripts/tabs.ts:9:7 code.typecheck/type-errorReliability
MediumTS2375: Type '{ effort: "high" | "medium" | "low" | "xhigh" | "max"; abortController: AbortController; env: { CLAUDE_AGE…packages/agent/src/auditors/factory.ts:104:11 code.typecheck/type-errorReliability
MediumTS2375: Type '{ summary: string; coverage?: string | undefined; }' is not assignable to type '{ summary: string; coverag…packages/agent/src/auditors/reporting.ts:216:3 code.typecheck/type-errorReliability

Coverage

24 auditors skipped, 0 errored

Examined Security, Accessibility, Performance, Privacy, Best practices, Reliability, Maintainability, Supply chain, Compliance.
Partly covered, because some of their auditors did not run: Security 19/36, Performance 2/3, Privacy 3/4, Best practices 7/12, Reliability 5/12, Maintainability 4/9, Supply chain 8/17. See why on the Auditors tab.

152 findings suppressed by openaudit.config.json (150 by path, 2 by fingerprint). Suppressed findings are not listed or scored.

Security

Vulnerabilities, exposed secrets, insecure configuration and missing defences.

code.hygiene passed
code.secrets passed
code.security failed
code.dependencies passed
code.api passed
code.gitleaks failed
code.semgrep skipped
code.osv-scanner skipped
code.trivy-fs skipped
code.trufflehog passed
code.bandit skipped
code.gosec skipped
code.brakeman skipped
code.pip-audit skipped
code.cargo-audit skipped
code.npm-audit passed
code.pnpm-audit passed
code.bun-audit passed
code.ruff skipped
code.shellcheck skipped
code.mobsfscan skipped
container.dockerfile passed
container.compose passed
container.image skipped
container.hadolint skipped
iac.github-actions passed
iac.zizmor skipped
iac.actionlint passed
iac.kubernetes passed
iac.kube-linter skipped
iac.terraform passed
iac.checkov skipped
mobile.android passed
mobile.ios passed
mobile.secrets passed
mobile.dependencies skipped

53 /1002 high, 1 medium

HighDetected a Generic API Key, potentially exposing access to various services and sensitive operations.code.gitleaks/generic-api-key2 findings
1. Highapps/cli/dist/cli.js:4019:59
  
  gitleaks rule `generic-api-key` matched a likely secret (entropy 3.52).
  
  Evidence
  key journeys, REDACTED
  
  Remediation
  Revoke and rotate the credential, purge it from git history, and load it from a secret manager or environment variable.
  
  References
  https://cwe.mitre.org/data/definitions/798.html (opens in a new tab)
  https://github.com/gitleaks/gitleaks (opens in a new tab)
  
  Rule
  code.gitleaks/generic-api-key
  Location
  apps/cli/dist/cli.js:4019:59
  Auditor
  code.gitleaks
  Confidence
  medium
  Tags
  cwe-798 (opens in a new tab)
  owasp-a07
  secrets
  Fingerprint
  03493c4acdb5cb9d
2. Highapps/cli/dist/cli.js:6743:6
  
  gitleaks rule `generic-api-key` matched a likely secret (entropy 3.72).
  
  Evidence
  api10: "REDACTED"
  
  Remediation
  Revoke and rotate the credential, purge it from git history, and load it from a secret manager or environment variable.
  
  References
  https://cwe.mitre.org/data/definitions/798.html (opens in a new tab)
  https://github.com/gitleaks/gitleaks (opens in a new tab)
  
  Rule
  code.gitleaks/generic-api-key
  Location
  apps/cli/dist/cli.js:6743:6
  Auditor
  code.gitleaks
  Confidence
  medium
  Tags
  cwe-798 (opens in a new tab)
  owasp-a07
  secrets
  Fingerprint
  640ebb6c6ecea3d1
MediumUnescaped HTML renderingapps/site/src/scripts/catalogue.ts:50code.security/xss
HTML is rendered without escaping. If the value contains user input, attackers can inject scripts (XSS).
Evidence
count.innerHTML = `<b class="num">${shown}</b> of ${items.length} auditors`;
Remediation
Render text instead of HTML (textContent, JSX children), or sanitize with a vetted library such as DOMPurify before inserting HTML.
References
https://cwe.mitre.org/data/definitions/79.html (opens in a new tab)
https://owasp.org/Top10/A03_2021-Injection/ (opens in a new tab)
Rule
code.security/xss
Location
apps/site/src/scripts/catalogue.ts:50
Auditor
code.security
Confidence
medium
Tags
cwe-79 (opens in a new tab)
owasp-a03
Fingerprint
4d1750eeb0977ac8

Accessibility

Barriers for people who use assistive technology, a keyboard or zoom (WCAG).

code.accessibility passed
mobile.accessibility passed

100 /100No findings

Accessibility is clean

2 auditors checked accessibility and reported nothing.

Performance

Load speed, payload size and runtime cost.

code.performance passed
container.dockerfile passed
mobile.performance skipped

100 /100No findings

Performance is clean

2 auditors checked performance and reported nothing.

Privacy

Tracking, third-party data flows and exposure of personal data.

code.privacy passed
code.mobsfscan skipped
mobile.android passed
mobile.ios passed

100 /100No findings

Privacy is clean

3 auditors checked privacy and reported nothing.

Best practices

Platform conventions and defensive defaults.

code.hygiene passed
code.quality failed
code.api passed
code.semgrep skipped
code.spectral skipped
container.dockerfile passed
container.hadolint skipped
iac.github-actions passed
iac.actionlint passed
iac.kube-linter skipped
iac.checkov skipped
mobile.android passed

100 /100No findings

Best practices is clean

7 auditors checked best practices and reported nothing.

Reliability

Correctness risks, error handling and operational robustness.

code.quality failed
code.typecheck failed
code.oxlint skipped
code.biome skipped
code.ruff skipped
code.staticcheck skipped
code.shellcheck skipped
code.spectral skipped
container.compose passed
iac.actionlint passed
iac.kubernetes passed
iac.kube-linter skipped

18 /10036 medium

MediumType errorcode.typecheck/type-error36 findings
1. MediumTS2379: Argument of type '{ explicit: string | undefined; noConfig: boolean | undefined; target: string; cwd: string; }'…apps/cli/src/audit.ts:208:23
  
  apps/cli/src/audit.ts(208,23): Argument of type '{ explicit: string | undefined; noConfig: boolean | undefined; target: string; cwd: string; }' is not assignable to parameter of type '{ readonly explicit?: string; readonly noConfig?: boolean; readonly target: string; readonly cwd: string; }' with 'exactOptionalPropertyTypes: true'. Consider adding 'undefined' to the types of the target's properties.
  
  Evidence
  TS2379: Argument of type '{ explicit: string | undefined; noConfig: boolean | undefined; target: string; cwd: string; }' is not assignable to parameter of type …
  
  Remediation
  Fix the type error. Code that does not type-check hides real bugs and defeats refactoring safety.
  
  References
  https://typescript.tv/errors/#ts2379 (opens in a new tab)
  
  Rule
  code.typecheck/type-error
  Location
  apps/cli/src/audit.ts:208:23
  Auditor
  code.typecheck
  Confidence
  high
  Tags
  ts2379
  typescript
  Fingerprint
  31db8f91c3c3e071
2. MediumTS2375: Type '{ offline: boolean | undefined; browser: boolean | undefined; maxPages: number | undefined; agentic: boole…apps/cli/src/audit.ts:291:5
  
  apps/cli/src/audit.ts(291,5): Type '{ offline: boolean | undefined; browser: boolean | undefined; maxPages: number | undefined; agentic: boolean | undefined; model: string | undefined; headers: { [x: string]: string; }; settings: { ...; } | undefined; }' is not assignable to type 'AuditOptions' with 'exactOptionalPropertyTypes: true'. Consider adding 'undefined' to the types of the target's properties.
  
  Evidence
  TS2375: Type '{ offline: boolean | undefined; browser: boolean | undefined; maxPages: number | undefined; agentic: boolean | undefined; model: string | undefine…
  
  Remediation
  Fix the type error. Code that does not type-check hides real bugs and defeats refactoring safety.
  
  References
  https://typescript.tv/errors/#ts2375 (opens in a new tab)
  
  Rule
  code.typecheck/type-error
  Location
  apps/cli/src/audit.ts:291:5
  Auditor
  code.typecheck
  Confidence
  high
  Tags
  ts2375
  typescript
  Fingerprint
  f67fa8e23997c06f
3. MediumTS2375: Type '{ source: string; rules: readonly string[] | undefined; paths: readonly string[] | undefined; fingerprints…apps/cli/src/audit.ts:313:3
  
  apps/cli/src/audit.ts(313,3): Type '{ source: string; rules: readonly string[] | undefined; paths: readonly string[] | undefined; fingerprints: readonly string[] | undefined; }' is not assignable to type 'SuppressionSource' with 'exactOptionalPropertyTypes: true'. Consider adding 'undefined' to the types of the target's properties.
  
  Evidence
  TS2375: Type '{ source: string; rules: readonly string[] | undefined; paths: readonly string[] | undefined; fingerprints: readonly string[] | undefined; }' is n…
  
  Remediation
  Fix the type error. Code that does not type-check hides real bugs and defeats refactoring safety.
  
  References
  https://typescript.tv/errors/#ts2375 (opens in a new tab)
  
  Rule
  code.typecheck/type-error
  Location
  apps/cli/src/audit.ts:313:3
  Auditor
  code.typecheck
  Confidence
  high
  Tags
  ts2375
  typescript
  Fingerprint
  0e241dfb0ce37f43
4. MediumTS2451: Cannot redeclare block-scoped variable 'still'.apps/site/src/scripts/hero.ts:9:7
  
  apps/site/src/scripts/hero.ts(9,7): Cannot redeclare block-scoped variable 'still'.
  
  Evidence
  TS2451: Cannot redeclare block-scoped variable 'still'.
  
  Remediation
  Fix the type error. Code that does not type-check hides real bugs and defeats refactoring safety.
  
  References
  https://typescript.tv/errors/#ts2451 (opens in a new tab)
  
  Rule
  code.typecheck/type-error
  Location
  apps/site/src/scripts/hero.ts:9:7
  Auditor
  code.typecheck
  Confidence
  high
  Tags
  ts2451
  typescript
  Fingerprint
  3d6f26578df0a850
5. MediumTS2451: Cannot redeclare block-scoped variable 'still'.apps/site/src/scripts/tabs.ts:9:7
  
  apps/site/src/scripts/tabs.ts(9,7): Cannot redeclare block-scoped variable 'still'.
  
  Evidence
  TS2451: Cannot redeclare block-scoped variable 'still'.
  
  Remediation
  Fix the type error. Code that does not type-check hides real bugs and defeats refactoring safety.
  
  References
  https://typescript.tv/errors/#ts2451 (opens in a new tab)
  
  Rule
  code.typecheck/type-error
  Location
  apps/site/src/scripts/tabs.ts:9:7
  Auditor
  code.typecheck
  Confidence
  high
  Tags
  ts2451
  typescript
  Fingerprint
  b711670311707b97
6. MediumTS2375: Type '{ effort: "high" | "medium" | "low" | "xhigh" | "max"; abortController: AbortController; env: { CLAUDE_AGE…packages/agent/src/auditors/factory.ts:104:11
  
  packages/agent/src/auditors/factory.ts(104,11): Type '{ effort: "high" | "medium" | "low" | "xhigh" | "max"; abortController: AbortController; env: { CLAUDE_AGENT_SDK_CLIENT_APP: string; NODE_ENV?: string; TZ?: string; }; stderr: (data: string) => void; ... 14 more ...; maxTurns: number; }' is not assignable to type 'Options' with 'exactOptionalPropertyTypes: true'. Consider adding 'undefined' to the types of the target's properties.
  
  Evidence
  TS2375: Type '{ effort: "high" | "medium" | "low" | "xhigh" | "max"; abortController: AbortController; env: { CLAUDE_AGENT_SDK_CLIENT_APP: string; NODE_ENV?: st…
  
  Remediation
  Fix the type error. Code that does not type-check hides real bugs and defeats refactoring safety.
  
  References
  https://typescript.tv/errors/#ts2375 (opens in a new tab)
  
  Rule
  code.typecheck/type-error
  Location
  packages/agent/src/auditors/factory.ts:104:11
  Auditor
  code.typecheck
  Confidence
  high
  Tags
  ts2375
  typescript
  Fingerprint
  09aa80a24b21ab74
7. MediumTS2375: Type '{ summary: string; coverage?: string | undefined; }' is not assignable to type '{ summary: string; coverag…packages/agent/src/auditors/reporting.ts:216:3
  
  packages/agent/src/auditors/reporting.ts(216,3): Type '{ summary: string; coverage?: string | undefined; }' is not assignable to type '{ summary: string; coverage?: string; }' with 'exactOptionalPropertyTypes: true'. Consider adding 'undefined' to the types of the target's properties.
  
  Evidence
  TS2375: Type '{ summary: string; coverage?: string | undefined; }' is not assignable to type '{ summary: string; coverage?: string; }' with 'exactOptionalProper…
  
  Remediation
  Fix the type error. Code that does not type-check hides real bugs and defeats refactoring safety.
  
  References
  https://typescript.tv/errors/#ts2375 (opens in a new tab)
  
  Rule
  code.typecheck/type-error
  Location
  packages/agent/src/auditors/reporting.ts:216:3
  Auditor
  code.typecheck
  Confidence
  high
  Tags
  ts2375
  typescript
  Fingerprint
  8e863625c431affb
8. MediumTS2375: Type '{ profile: string | undefined; regions: string[]; checks: string[]; services: string[]; compliance: string…packages/auditors/src/cloud/prowler.ts:86:2
  
  packages/auditors/src/cloud/prowler.ts(86,2): Type '{ profile: string | undefined; regions: string[]; checks: string[]; services: string[]; compliance: string | undefined; azureAuth: keyof typeof AZURE_AUTH; projectIds: string[]; context: string | undefined; }' is not assignable to type 'ProwlerSettings' with 'exactOptionalPropertyTypes: true'. Consider adding 'undefined' to the types of the target's properties.
  
  Evidence
  TS2375: Type '{ profile: string | undefined; regions: string[]; checks: string[]; services: string[]; compliance: string | undefined; azureAuth: keyo* typeof AZ…
  
  Remediation
  Fix the type error. Code that does not type-check hides real bugs and defeats refactoring safety.
  
  References
  https://typescript.tv/errors/#ts2375 (opens in a new tab)
  
  Rule
  code.typecheck/type-error
  Location
  packages/auditors/src/cloud/prowler.ts:86:2
  Auditor
  code.typecheck
  Confidence
  high
  Tags
  ts2375
  typescript
  Fingerprint
  707a688fd0c8afe2
9. MediumTS2379: Argument of type '{ file: string | undefined; line: number; column: number; code: string; message: string; }' is…packages/auditors/src/codebase/lint-js.ts:131:13
  
  packages/auditors/src/codebase/lint-js.ts(131,13): Argument of type '{ file: string | undefined; line: number; column: number; code: string; message: string; }' is not assignable to parameter of type 'TscDiagnostic' with 'exactOptionalPropertyTypes: true'. Consider adding 'undefined' to the types of the target's properties.
  
  Evidence
  TS2379: Argument of type '{ file: string | undefined; line: number; column: number; code: string; message: string; }' is not assignable to parameter of type 'Ts…
  
  Remediation
  Fix the type error. Code that does not type-check hides real bugs and defeats refactoring safety.
  
  References
  https://typescript.tv/errors/#ts2379 (opens in a new tab)
  
  Rule
  code.typecheck/type-error
  Location
  packages/auditors/src/codebase/lint-js.ts:131:13
  Auditor
  code.typecheck
  Confidence
  high
  Tags
  ts2379
  typescript
  Fingerprint
  b1779aedfa121824
10. MediumTS2379: Argument of type '{ cwd: string; timeoutMs: number; env: Record<string, string> | undefined; }' is not assignabl…packages/auditors/src/codebase/lint-langs/shared.ts:52:21
  
  packages/auditors/src/codebase/lint-langs/shared.ts(52,21): Argument of type '{ cwd: string; timeoutMs: number; env: Record<string, string> | undefined; }' is not assignable to parameter of type 'ExecOptions' with 'exactOptionalPropertyTypes: true'. Consider adding 'undefined' to the types of the target's properties.
  
  Evidence
  TS2379: Argument of type '{ cwd: string; timeoutMs: number; env: Record<string, string> | undefined; }' is not assignable to parameter of type 'ExecOptions' wit…
  
  Remediation
  Fix the type error. Code that does not type-check hides real bugs and defeats refactoring safety.
  
  References
  https://typescript.tv/errors/#ts2379 (opens in a new tab)
  
  Rule
  code.typecheck/type-error
  Location
  packages/auditors/src/codebase/lint-langs/shared.ts:52:21
  Auditor
  code.typecheck
  Confidence
  high
  Tags
  ts2379
  typescript
  Fingerprint
  42d066cf096947e1
11. MediumTS2375: Type '{ findings: FindingInput[]; console: { path: string; count: number; firstLine: number; } | undefined; }' i…packages/auditors/src/codebase/performance.ts:329:2
  
  packages/auditors/src/codebase/performance.ts(329,2): Type '{ findings: FindingInput[]; console: { path: string; count: number; firstLine: number; } | undefined; }' is not assignable to type '{ findings: FindingInput[]; console?: ConsoleCount; }' with 'exactOptionalPropertyTypes: true'. Consider adding 'undefined' to the types of the target's properties.
  
  Evidence
  TS2375: Type '{ findings: FindingInput[]; console: { path: string; count: number; firstLine: number; } | undefined; }' is not assignable to type '{ findings: Fi…
  
  Remediation
  Fix the type error. Code that does not type-check hides real bugs and defeats refactoring safety.
  
  References
  https://typescript.tv/errors/#ts2375 (opens in a new tab)
  
  Rule
  code.typecheck/type-error
  Location
  packages/auditors/src/codebase/performance.ts:329:2
  Auditor
  code.typecheck
  Confidence
  high
  Tags
  ts2375
  typescript
  Fingerprint
  85c676a4812a5d5e
12. MediumTS2379: Argument of type '{ path: string; line: number | undefined; via: string; }' is not assignable to parameter of ty…packages/auditors/src/codebase/privacy.ts:797:20
  
  packages/auditors/src/codebase/privacy.ts(797,20): Argument of type '{ path: string; line: number | undefined; via: string; }' is not assignable to parameter of type 'Sighting' with 'exactOptionalPropertyTypes: true'. Consider adding 'undefined' to the types of the target's properties.
  
  Evidence
  TS2379: Argument of type '{ path: string; line: number | undefined; via: string; }' is not assignable to parameter of type 'Sighting' with 'exactOptionalPropert…
  
  Remediation
  Fix the type error. Code that does not type-check hides real bugs and defeats refactoring safety.
  
  References
  https://typescript.tv/errors/#ts2379 (opens in a new tab)
  
  Rule
  code.typecheck/type-error
  Location
  packages/auditors/src/codebase/privacy.ts:797:20
  Auditor
  code.typecheck
  Confidence
  high
  Tags
  ts2379
  typescript
  Fingerprint
  82b091555d99bd98
13. MediumTS2322: Type '{ rule: string; description: string | undefined; file: string; secret: string; match: string; commit: stri…packages/auditors/src/codebase/secrets-history.ts:241:2
  
  packages/auditors/src/codebase/secrets-history.ts(241,2): Type '{ rule: string; description: string | undefined; file: string; secret: string; match: string; commit: string; author: string | undefined; date: string | undefined; entropy: number | undefined; tags: string[]; }[]' is not assignable to type 'Hit[]'.
  
  Evidence
  TS2322: Type '{ rule: string; description: string | undefined; file: string; secret: stri**; match: string; commit: string; author: stri** | undefined; date: st…
  
  Remediation
  Fix the type error. Code that does not type-check hides real bugs and defeats refactoring safety.
  
  References
  https://typescript.tv/errors/#ts2322 (opens in a new tab)
  
  Rule
  code.typecheck/type-error
  Location
  packages/auditors/src/codebase/secrets-history.ts:241:2
  Auditor
  code.typecheck
  Confidence
  high
  Tags
  ts2322
  typescript
  Fingerprint
  1de2261f0d67cd84
14. MediumTS2379: Argument of type '{ title: string; severity: "low"; message: string; remediation: string; file: string | undefin…packages/auditors/src/codebase/strictness.ts:383:39
  
  packages/auditors/src/codebase/strictness.ts(383,39): Argument of type '{ title: string; severity: "low"; message: string; remediation: string; file: string | undefined; tags: string[]; }' is not assignable to parameter of type '{ title: string; severity: "critical" | "high" | "medium" | "low" | "info"; message: string; remediation: string; file?: string; line?: number; evidence?: string; confidence?: "high" | "medium" | "low"; tags?: readonly string[]; references?: readonly string[]; }' with 'exactOptionalPropertyTypes: true'. Consider adding 'undefined' to the types of the target's properties.
  
  Evidence
  TS2379: Argument of type '{ title: string; severity: "low"; message: string; remediation: string; file: string | undefined; tags: string[]; }' is not assignable…
  
  Remediation
  Fix the type error. Code that does not type-check hides real bugs and defeats refactoring safety.
  
  References
  https://typescript.tv/errors/#ts2379 (opens in a new tab)
  
  Rule
  code.typecheck/type-error
  Location
  packages/auditors/src/codebase/strictness.ts:383:39
  Auditor
  code.typecheck
  Confidence
  high
  Tags
  ts2379
  typescript
  Fingerprint
  f242361c1a5ae307
15. MediumTS2379: Argument of type '{ auditor: string; name: string; version: string | undefined; ecosystem: string; id: string; a…packages/auditors/src/codebase/supply-chain/go.ts:152:31
  
  packages/auditors/src/codebase/supply-chain/go.ts(152,31): Argument of type '{ auditor: string; name: string; version: string | undefined; ecosystem: string; id: string; aliases: readonly string[] | undefined; summary: string; severity: "critical" | "high" | "medium" | "low" | "info"; ... 7 more ...; tags: string[]; }' is not assignable to parameter of type 'VulnInput' with 'exactOptionalPropertyTypes: true'. Consider adding 'undefined' to the types of the target's properties.
  
  Evidence
  TS2379: Argument of type '{ auditor: string; name: string; version: string | undefined; ecosystem: string; id: string; aliases: readonly string[] | undefined; s…
  
  Remediation
  Fix the type error. Code that does not type-check hides real bugs and defeats refactoring safety.
  
  References
  https://typescript.tv/errors/#ts2379 (opens in a new tab)
  
  Rule
  code.typecheck/type-error
  Location
  packages/auditors/src/codebase/supply-chain/go.ts:152:31
  Auditor
  code.typecheck
  Confidence
  high
  Tags
  ts2379
  typescript
  Fingerprint
  933aa0f902719281
16. MediumTS2412: Type '{ file: string | undefined; line: number | undefined; fn: string | undefined; } | undefined' is not assign…packages/auditors/src/codebase/supply-chain/go.ts:99:3
  
  packages/auditors/src/codebase/supply-chain/go.ts(99,3): Type '{ file: string | undefined; line: number | undefined; fn: string | undefined; } | undefined' is not assignable to type '{ file?: string; line?: number; fn?: string; } | undefined' with 'exactOptionalPropertyTypes: true'. Consider adding 'undefined' to the type of the target.
  
  Evidence
  TS2412: Type '{ file: string | undefined; line: number | undefined; fn: string | undefined; } | undefined' is not assignable to type '{ file?: string; line?: nu…
  
  Remediation
  Fix the type error. Code that does not type-check hides real bugs and defeats refactoring safety.
  
  References
  https://typescript.tv/errors/#ts2412 (opens in a new tab)
  
  Rule
  code.typecheck/type-error
  Location
  packages/auditors/src/codebase/supply-chain/go.ts:99:3
  Auditor
  code.typecheck
  Confidence
  high
  Tags
  ts2412
  typescript
  Fingerprint
  fcc43586f15b86b7
17. MediumTS2379: Argument of type '{ auditor: string; name: string; version: string | undefined; ecosystem: string | undefined; i…packages/auditors/src/codebase/supply-chain/grype-syft.ts:67:16
  
  packages/auditors/src/codebase/supply-chain/grype-syft.ts(67,16): Argument of type '{ auditor: string; name: string; version: string | undefined; ecosystem: string | undefined; id: string; aliases: string[]; summary: string; severity: "critical" | "high" | "medium" | "low" | "info"; ... 6 more ...; tags: string[]; }' is not assignable to parameter of type 'VulnInput' with 'exactOptionalPropertyTypes: true'. Consider adding 'undefined' to the types of the target's properties.
  
  Evidence
  TS2379: Argument of type '{ auditor: string; name: string; version: string | undefined; ecosystem: string | undefined; id: string; aliases: string[]; summary: s…
  
  Remediation
  Fix the type error. Code that does not type-check hides real bugs and defeats refactoring safety.
  
  References
  https://typescript.tv/errors/#ts2379 (opens in a new tab)
  
  Rule
  code.typecheck/type-error
  Location
  packages/auditors/src/codebase/supply-chain/grype-syft.ts:67:16
  Auditor
  code.typecheck
  Confidence
  high
  Tags
  ts2379
  typescript
  Fingerprint
  3d2a084e1e3771f4
18. MediumTS2379: Argument of type '{ auditor: string; name: string; version: string | undefined; ecosystem: string; id: string; a…packages/auditors/src/codebase/supply-chain/js-audits.ts:150:17
  
  packages/auditors/src/codebase/supply-chain/js-audits.ts(150,17): Argument of type '{ auditor: string; name: string; version: string | undefined; ecosystem: string; id: string; aliases: string[]; summary: string; severity: "critical" | "high" | "medium" | "low" | "info"; fixed: string[]; file: string | undefined; references: string[]; tags: string[]; }' is not assignable to parameter of type 'VulnInput' with 'exactOptionalPropertyTypes: true'. Consider adding 'undefined' to the types of the target's properties.
  
  Evidence
  TS2379: Argument of type '{ auditor: string; name: string; version: string | undefined; ecosystem: string; id: string; aliases: string[]; summary: string; sever…
  
  Remediation
  Fix the type error. Code that does not type-check hides real bugs and defeats refactoring safety.
  
  References
  https://typescript.tv/errors/#ts2379 (opens in a new tab)
  
  Rule
  code.typecheck/type-error
  Location
  packages/auditors/src/codebase/supply-chain/js-audits.ts:150:17
  Auditor
  code.typecheck
  Confidence
  high
  Tags
  ts2379
  typescript
  Fingerprint
  1e8d8901d8b4a1c3
19. MediumTS2379: Argument of type '{ cwd: string; okCodes: number[]; env: Record<string, string> | undefined; }' is not assignabl…packages/auditors/src/codebase/supply-chain/js-audits.ts:274:66
  
  packages/auditors/src/codebase/supply-chain/js-audits.ts(274,66): Argument of type '{ cwd: string; okCodes: number[]; env: Record<string, string> | undefined; }' is not assignable to parameter of type '{ cwd: string; okCodes: readonly number[]; env?: Record<string, string>; }' with 'exactOptionalPropertyTypes: true'. Consider adding 'undefined' to the types of the target's properties.
  
  Evidence
  TS2379: Argument of type '{ cwd: string; okCodes: number[]; env: Record<string, string> | undefined; }' is not assignable to parameter of type '{ cwd: string; o…
  
  Remediation
  Fix the type error. Code that does not type-check hides real bugs and defeats refactoring safety.
  
  References
  https://typescript.tv/errors/#ts2379 (opens in a new tab)
  
  Rule
  code.typecheck/type-error
  Location
  packages/auditors/src/codebase/supply-chain/js-audits.ts:274:66
  Auditor
  code.typecheck
  Confidence
  high
  Tags
  ts2379
  typescript
  Fingerprint
  290d8ec8e4a330de
20. MediumTS2379: Argument of type '{ auditor: string; name: string; version: string | undefined; ecosystem: string; id: string; s…packages/auditors/src/codebase/supply-chain/js-audits.ts:93:17
  
  packages/auditors/src/codebase/supply-chain/js-audits.ts(93,17): Argument of type '{ auditor: string; name: string; version: string | undefined; ecosystem: string; id: string; summary: string; severity: "critical" | "high" | "medium" | "low" | "info"; fixed: string[]; fixHint: string | undefined; file: string | undefined; references: string[]; tags: string[]; }' is not assignable to parameter of type 'VulnInput' with 'exactOptionalPropertyTypes: true'. Consider adding 'undefined' to the types of the target's properties.
  
  Evidence
  TS2379: Argument of type '{ auditor: string; name: string; version: string | undefined; ecosystem: string; id: string; summary: string; severity: "critical" | "…
  
  Remediation
  Fix the type error. Code that does not type-check hides real bugs and defeats refactoring safety.
  
  References
  https://typescript.tv/errors/#ts2379 (opens in a new tab)
  
  Rule
  code.typecheck/type-error
  Location
  packages/auditors/src/codebase/supply-chain/js-audits.ts:93:17
  Auditor
  code.typecheck
  Confidence
  high
  Tags
  ts2379
  typescript
  Fingerprint
  1d7f870346729384
21. MediumTS2379: Argument of type '{ auditor: string; name: string; version: string | undefined; ecosystem: string; id: string; a…packages/auditors/src/codebase/supply-chain/python.ts:125:17
  
  packages/auditors/src/codebase/supply-chain/python.ts(125,17): Argument of type '{ auditor: string; name: string; version: string | undefined; ecosystem: string; id: string; aliases: string[]; summary: string; severity: "medium"; fixed: string[]; file: string | undefined; references: string[]; }' is not assignable to parameter of type 'VulnInput' with 'exactOptionalPropertyTypes: true'. Consider adding 'undefined' to the types of the target's properties.
  
  Evidence
  TS2379: Argument of type '{ auditor: string; name: string; version: string | undefined; ecosystem: string; id: string; aliases: string[]; summary: string; sever…
  
  Remediation
  Fix the type error. Code that does not type-check hides real bugs and defeats refactoring safety.
  
  References
  https://typescript.tv/errors/#ts2379 (opens in a new tab)
  
  Rule
  code.typecheck/type-error
  Location
  packages/auditors/src/codebase/supply-chain/python.ts:125:17
  Auditor
  code.typecheck
  Confidence
  high
  Tags
  ts2379
  typescript
  Fingerprint
  04f1403e741a2496
22. MediumTS2379: Argument of type '{ auditor: string; name: string; version: string | undefined; ecosystem: string; id: string; a…packages/auditors/src/codebase/supply-chain/rust.ts:74:16
  
  packages/auditors/src/codebase/supply-chain/rust.ts(74,16): Argument of type '{ auditor: string; name: string; version: string | undefined; ecosystem: string; id: string; aliases: string[]; summary: string; severity: "critical" | "high" | "medium" | "low" | "info"; fixed: string[]; file: string; references: string[]; }' is not assignable to parameter of type 'VulnInput' with 'exactOptionalPropertyTypes: true'. Consider adding 'undefined' to the types of the target's properties.
  
  Evidence
  TS2379: Argument of type '{ auditor: string; name: string; version: string | undefined; ecosystem: string; id: string; aliases: string[]; summary: string; sever…
  
  Remediation
  Fix the type error. Code that does not type-check hides real bugs and defeats refactoring safety.
  
  References
  https://typescript.tv/errors/#ts2379 (opens in a new tab)
  
  Rule
  code.typecheck/type-error
  Location
  packages/auditors/src/codebase/supply-chain/rust.ts:74:16
  Auditor
  code.typecheck
  Confidence
  high
  Tags
  ts2379
  typescript
  Fingerprint
  301ccaed18cc3be1
23. MediumTS2379: Argument of type '{ cwd: string; timeoutMs: number; env: Record<string, string> | undefined; }' is not assignabl…packages/auditors/src/codebase/supply-chain/shared.ts:80:21
  
  packages/auditors/src/codebase/supply-chain/shared.ts(80,21): Argument of type '{ cwd: string; timeoutMs: number; env: Record<string, string> | undefined; }' is not assignable to parameter of type 'ExecOptions' with 'exactOptionalPropertyTypes: true'. Consider adding 'undefined' to the types of the target's properties.
  
  Evidence
  TS2379: Argument of type '{ cwd: string; timeoutMs: number; env: Record<string, string> | undefined; }' is not assignable to parameter of type 'ExecOptions' wit…
  
  Remediation
  Fix the type error. Code that does not type-check hides real bugs and defeats refactoring safety.
  
  References
  https://typescript.tv/errors/#ts2379 (opens in a new tab)
  
  Rule
  code.typecheck/type-error
  Location
  packages/auditors/src/codebase/supply-chain/shared.ts:80:21
  Auditor
  code.typecheck
  Confidence
  high
  Tags
  ts2379
  typescript
  Fingerprint
  23b70775caacabfb
24. MediumTS2379: Argument of type '{ dockerignore: { path: string; text: string; } | undefined; hasPackageJson: boolean; }' is no…packages/auditors/src/infra/dockerfile.ts:610:37
  
  packages/auditors/src/infra/dockerfile.ts(610,37): Argument of type '{ dockerignore: { path: string; text: string; } | undefined; hasPackageJson: boolean; }' is not assignable to parameter of type '{ readonly dockerignore?: { readonly path: string; readonly text: string; }; readonly hasPackageJson?: boolean; }' with 'exactOptionalPropertyTypes: true'. Consider adding 'undefined' to the types of the target's properties.
  
  Evidence
  TS2379: Argument of type '{ dockerignore: { path: string; text: string; } | undefined; hasPackageJson: boolean; }' is not assignable to parameter of type '{ rea…
  
  Remediation
  Fix the type error. Code that does not type-check hides real bugs and defeats refactoring safety.
  
  References
  https://typescript.tv/errors/#ts2379 (opens in a new tab)
  
  Rule
  code.typecheck/type-error
  Location
  packages/auditors/src/infra/dockerfile.ts:610:37
  Auditor
  code.typecheck
  Confidence
  high
  Tags
  ts2379
  typescript
  Fingerprint
  522c958c9a455413
25. MediumTS2379: Argument of type '{ cwd: string; timeoutMs: number; env: { GH_TOKEN: string; } | undefined; }' is not assignable…packages/auditors/src/infra/zizmor.ts:157:5
  
  packages/auditors/src/infra/zizmor.ts(157,5): Argument of type '{ cwd: string; timeoutMs: number; env: { GH_TOKEN: string; } | undefined; }' is not assignable to parameter of type 'ExecOptions' with 'exactOptionalPropertyTypes: true'. Consider adding 'undefined' to the types of the target's properties.
  
  Evidence
  TS2379: Argument of type '{ cwd: string; timeoutMs: number; env: { GH_TOKEN: stri**; } | undefined; }' is not assignable to parameter of type 'ExecOptions' with…
  
  Remediation
  Fix the type error. Code that does not type-check hides real bugs and defeats refactoring safety.
  
  References
  https://typescript.tv/errors/#ts2379 (opens in a new tab)
  
  Rule
  code.typecheck/type-error
  Location
  packages/auditors/src/infra/zizmor.ts:157:5
  Auditor
  code.typecheck
  Confidence
  high
  Tags
  ts2379
  typescript
  Fingerprint
  5bf9299c1d591b1e
26. MediumTS2379: Argument of type '{ file: string; value: PlistDict; text: string | undefined; format: "plist"; }' is not assigna…packages/auditors/src/mobile/ios.ts:309:24
  
  packages/auditors/src/mobile/ios.ts(309,24): Argument of type '{ file: string; value: PlistDict; text: string | undefined; format: "plist"; }' is not assignable to parameter of type 'PlistSource' with 'exactOptionalPropertyTypes: true'. Consider adding 'undefined' to the types of the target's properties.
  
  Evidence
  TS2379: Argument of type '{ file: string; value: PlistDict; text: string | undefined; format: "plist"; }' is not assignable to parameter of type 'PlistSource' w…
  
  Remediation
  Fix the type error. Code that does not type-check hides real bugs and defeats refactoring safety.
  
  References
  https://typescript.tv/errors/#ts2379 (opens in a new tab)
  
  Rule
  code.typecheck/type-error
  Location
  packages/auditors/src/mobile/ios.ts:309:24
  Auditor
  code.typecheck
  Confidence
  high
  Tags
  ts2379
  typescript
  Fingerprint
  c759d1daea77089f
27. MediumTS2412: Type 'undefined' is not assignable to type 'string' with 'exactOptionalPropertyTypes: true'. Consider adding 'un…packages/auditors/src/mobile/plist.ts:47:4
  
  packages/auditors/src/mobile/plist.ts(47,4): Type 'undefined' is not assignable to type 'string' with 'exactOptionalPropertyTypes: true'. Consider adding 'undefined' to the type of the target.
  
  Evidence
  TS2412: Type 'undefined' is not assignable to type 'string' with 'exactOptionalPropertyTypes: true'. Consider adding 'undefined' to the type of the target.
  
  Remediation
  Fix the type error. Code that does not type-check hides real bugs and defeats refactoring safety.
  
  References
  https://typescript.tv/errors/#ts2412 (opens in a new tab)
  
  Rule
  code.typecheck/type-error
  Location
  packages/auditors/src/mobile/plist.ts:47:4
  Auditor
  code.typecheck
  Confidence
  high
  Tags
  ts2412
  typescript
  Fingerprint
  f6b3985267009a27
28. MediumTS2379: Argument of type '{ connectHost: string | undefined; }' is not assignable to parameter of type '{ timeoutMs?: nu…packages/auditors/src/web/tls.ts:361:59
  
  packages/auditors/src/web/tls.ts(361,59): Argument of type '{ connectHost: string | undefined; }' is not assignable to parameter of type '{ timeoutMs?: number; minVersion?: SecureVersion; maxVersion?: SecureVersion; connectHost?: string; }' with 'exactOptionalPropertyTypes: true'. Consider adding 'undefined' to the types of the target's properties.
  
  Evidence
  TS2379: Argument of type '{ connectHost: string | undefined; }' is not assignable to parameter of type '{ timeoutMs?: number; minVersion?: SecureVersion; maxVer…
  
  Remediation
  Fix the type error. Code that does not type-check hides real bugs and defeats refactoring safety.
  
  References
  https://typescript.tv/errors/#ts2379 (opens in a new tab)
  
  Rule
  code.typecheck/type-error
  Location
  packages/auditors/src/web/tls.ts:361:59
  Auditor
  code.typecheck
  Confidence
  high
  Tags
  ts2379
  typescript
  Fingerprint
  13153ef63a985168
29. MediumTS2379: Argument of type '{ connectHost: string | undefined; minVersion: "TLSv1"; maxVersion: "TLSv1.1"; timeoutMs: numb…packages/auditors/src/web/tls.ts:373:62
  
  packages/auditors/src/web/tls.ts(373,62): Argument of type '{ connectHost: string | undefined; minVersion: "TLSv1"; maxVersion: "TLSv1.1"; timeoutMs: number; }' is not assignable to parameter of type '{ timeoutMs?: number; minVersion?: SecureVersion; maxVersion?: SecureVersion; connectHost?: string; }' with 'exactOptionalPropertyTypes: true'. Consider adding 'undefined' to the types of the target's properties.
  
  Evidence
  TS2379: Argument of type '{ connectHost: string | undefined; minVersion: "TLSv1"; maxVersion: "TLSv1.1"; timeoutMs: number; }' is not assignable to parameter of…
  
  Remediation
  Fix the type error. Code that does not type-check hides real bugs and defeats refactoring safety.
  
  References
  https://typescript.tv/errors/#ts2379 (opens in a new tab)
  
  Rule
  code.typecheck/type-error
  Location
  packages/auditors/src/web/tls.ts:373:62
  Auditor
  code.typecheck
  Confidence
  high
  Tags
  ts2379
  typescript
  Fingerprint
  0fc934a7dce34088
30. MediumTS2379: Argument of type '{ headers: Record<string, string> | undefined; method?: string; body?: string; redirect?: "fol…packages/core/src/engine.ts:248:23
  
  packages/core/src/engine.ts(248,23): Argument of type '{ headers: Record<string, string> | undefined; method?: string; body?: string; redirect?: "follow" | "manual"; timeoutMs?: number; maxBytes?: number; }' is not assignable to parameter of type 'HttpRequest' with 'exactOptionalPropertyTypes: true'. Consider adding 'undefined' to the types of the target's properties.
  
  Evidence
  TS2379: Argument of type '{ headers: Record<string, string> | undefined; method?: string; body?: string; redirect?: "follow" | "manual"; timeoutMs?: number; max…
  
  Remediation
  Fix the type error. Code that does not type-check hides real bugs and defeats refactoring safety.
  
  References
  https://typescript.tv/errors/#ts2379 (opens in a new tab)
  
  Rule
  code.typecheck/type-error
  Location
  packages/core/src/engine.ts:248:23
  Auditor
  code.typecheck
  Confidence
  high
  Tags
  ts2379
  typescript
  Fingerprint
  70e4ff76d0a9a23a
31. MediumTS2379: Argument of type '{ suppressed: readonly SuppressionSummary[] | undefined; }' is not assignable to parameter of …packages/core/src/reporters/html.ts:189:29
  
  packages/core/src/reporters/html.ts(189,29): Argument of type '{ suppressed: readonly SuppressionSummary[] | undefined; }' is not assignable to parameter of type 'MarkdownOptions' with 'exactOptionalPropertyTypes: true'. Consider adding 'undefined' to the types of the target's properties.
  
  Evidence
  TS2379: Argument of type '{ suppressed: readonly SuppressionSummary[] | undefined; }' is not assignable to parameter of type 'MarkdownOptions' with 'exactOption…
  
  Remediation
  Fix the type error. Code that does not type-check hides real bugs and defeats refactoring safety.
  
  References
  https://typescript.tv/errors/#ts2379 (opens in a new tab)
  
  Rule
  code.typecheck/type-error
  Location
  packages/core/src/reporters/html.ts:189:29
  Auditor
  code.typecheck
  Confidence
  high
  Tags
  ts2379
  typescript
  Fingerprint
  08cfba88fb210ccc
32. MediumTS2379: Argument of type '{ suppressed: readonly SuppressionSummary[] | undefined; }' is not assignable to parameter of …packages/core/src/reporters/index.ts:69:30
  
  packages/core/src/reporters/index.ts(69,30): Argument of type '{ suppressed: readonly SuppressionSummary[] | undefined; }' is not assignable to parameter of type 'MarkdownOptions' with 'exactOptionalPropertyTypes: true'. Consider adding 'undefined' to the types of the target's properties.
  
  Evidence
  TS2379: Argument of type '{ suppressed: readonly SuppressionSummary[] | undefined; }' is not assignable to parameter of type 'MarkdownOptions' with 'exactOption…
  
  Remediation
  Fix the type error. Code that does not type-check hides real bugs and defeats refactoring safety.
  
  References
  https://typescript.tv/errors/#ts2379 (opens in a new tab)
  
  Rule
  code.typecheck/type-error
  Location
  packages/core/src/reporters/index.ts:69:30
  Auditor
  code.typecheck
  Confidence
  high
  Tags
  ts2379
  typescript
  Fingerprint
  eb58639ab0d583cb
33. MediumTS2379: Argument of type '{ suppressed: readonly SuppressionSummary[] | undefined; }' is not assignable to parameter of …packages/core/src/reporters/index.ts:71:26
  
  packages/core/src/reporters/index.ts(71,26): Argument of type '{ suppressed: readonly SuppressionSummary[] | undefined; }' is not assignable to parameter of type 'HtmlOptions' with 'exactOptionalPropertyTypes: true'. Consider adding 'undefined' to the types of the target's properties.
  
  Evidence
  TS2379: Argument of type '{ suppressed: readonly SuppressionSummary[] | undefined; }' is not assignable to parameter of type 'HtmlOptions' with 'exactOptionalPr…
  
  Remediation
  Fix the type error. Code that does not type-check hides real bugs and defeats refactoring safety.
  
  References
  https://typescript.tv/errors/#ts2379 (opens in a new tab)
  
  Rule
  code.typecheck/type-error
  Location
  packages/core/src/reporters/index.ts:71:26
  Auditor
  code.typecheck
  Confidence
  high
  Tags
  ts2379
  typescript
  Fingerprint
  e82322517e90505b
34. MediumTS2769: No overload matches this call.packages/core/src/services.ts:303:33
  
  packages/core/src/services.ts(303,33): No overload matches this call.
  
  Evidence
  TS2769: No overload matches this call.
  
  Remediation
  Fix the type error. Code that does not type-check hides real bugs and defeats refactoring safety.
  
  References
  https://typescript.tv/errors/#ts2769 (opens in a new tab)
  
  Rule
  code.typecheck/type-error
  Location
  packages/core/src/services.ts:303:33
  Auditor
  code.typecheck
  Confidence
  high
  Tags
  ts2769
  typescript
  Fingerprint
  7842d2a480623a1e
35. MediumTS2379: Argument of type '{ cwd: string | undefined; env: { [x: string]: string | undefined; NODE_ENV?: string; TZ?: str…packages/core/src/services.ts:407:39
  
  packages/core/src/services.ts(407,39): Argument of type '{ cwd: string | undefined; env: { [x: string]: string | undefined; NODE_ENV?: string; TZ?: string; }; stdout: "pipe"; stderr: "pipe"; stdin: "ignore"; }' is not assignable to parameter of type 'SpawnOptions<"ignore", "pipe", "pipe">' with 'exactOptionalPropertyTypes: true'. Consider adding 'undefined' to the types of the target's properties.
  
  Evidence
  TS2379: Argument of type '{ cwd: string | undefined; env: { [x: string]: string | undefined; NODE_ENV?: string; TZ?: string; }; stdout: "pipe"; stderr: "pipe"; …
  
  Remediation
  Fix the type error. Code that does not type-check hides real bugs and defeats refactoring safety.
  
  References
  https://typescript.tv/errors/#ts2379 (opens in a new tab)
  
  Rule
  code.typecheck/type-error
  Location
  packages/core/src/services.ts:407:39
  Auditor
  code.typecheck
  Confidence
  high
  Tags
  ts2379
  typescript
  Fingerprint
  25d8103a5938be9b
36. MediumTS2379: Argument of type '{ body: BodyInit | null; cache?: RequestCache; credentials?: RequestCredentials; headers?: Hea…packages/core/src/ssrf.ts:467:5
  
  packages/core/src/ssrf.ts(467,5): Argument of type '{ body: BodyInit | null; cache?: RequestCache; credentials?: RequestCredentials; headers?: HeadersInit; integrity?: string; keepalive?: boolean; method: string; mode?: RequestMode; priority?: RequestPriority; ... 5 more ...; tls?: { serverName?: string; }; }' is not assignable to parameter of type 'RequestInit' with 'exactOptionalPropertyTypes: true'. Consider adding 'undefined' to the types of the target's properties.
  
  Evidence
  TS2379: Argument of type '{ body: BodyInit | null; cache?: RequestCache; credentials?: RequestCredentials; headers?: HeadersInit; integrity?: string; keepalive?…
  
  Remediation
  Fix the type error. Code that does not type-check hides real bugs and defeats refactoring safety.
  
  References
  https://typescript.tv/errors/#ts2379 (opens in a new tab)
  
  Rule
  code.typecheck/type-error
  Location
  packages/core/src/ssrf.ts:467:5
  Auditor
  code.typecheck
  Confidence
  high
  Tags
  ts2379
  typescript
  Fingerprint
  b15e35f2051a3a66

Maintainability

Code health: complexity, duplication, dead code and hygiene.

code.hygiene passed
code.quality failed
code.strictness passed
code.jscpd skipped
code.typecheck failed
code.oxlint skipped
code.biome skipped
code.ruff skipped
code.staticcheck skipped

98 /1001 low

LowLarge file (1049 lines)packages/mcp/src/server.tscode.quality/large-file

packages/mcp/src/server.ts has 1049 lines. Very large files are hard to review, test and change safely.

Remediation
Split it into smaller modules with a single responsibility each.

Rule
code.quality/large-file
Location
packages/mcp/src/server.ts
Auditor
code.quality
Confidence
high
Fingerprint
5d56c2ba07a2a90a

Supply chain

Dependencies, provenance, pinning and build integrity.

code.dependencies passed
code.osv-scanner skipped
code.trivy-fs skipped
code.brakeman skipped
code.pip-audit skipped
code.cargo-audit skipped
code.npm-audit passed
code.pnpm-audit passed
code.bun-audit passed
code.scorecard skipped
container.dockerfile passed
container.compose passed
container.image skipped
iac.github-actions passed
iac.zizmor skipped
iac.kubernetes passed
mobile.dependencies skipped

100 /100No findings

Supply chain is clean

8 auditors checked supply chain and reported nothing.

Compliance

Licence and policy obligations.

code.privacy passed

100 /100No findings

Compliance is clean

1 auditor checked compliance and reported nothing.

OWASP and CWE

Findings mapped to the OWASP Top 10 (2021) and the 2024 CWE Top 25 Most Dangerous Software Weaknesses.

“No findings” is not the same as compliant. It only means none of the auditors that ran reported an issue mapped to that control. Many controls, such as access control and insecure design, need a manual review that tools cannot do.

Findings are grouped by their owasp-a01 to owasp-a10 and cwe-N tags. A finding with a CWE but no OWASP tag is placed through MITRE's CWE-1344 view of the OWASP Top Ten 2021. Duplicates confirmed by several tools count once.

OWASP Top 10 (2021)

2 of 10 with findings

A01Broken Access Controlno findings
A02Cryptographic Failuresno findings
A03InjectionMedium1 finding
1. MediumUnescaped HTML renderingapps/site/src/scripts/catalogue.ts:50 code.security/xssSecurity
A04Insecure Designno findings
A05Security Misconfigurationno findings
A06Vulnerable and Outdated Componentsno findings
A07Identification and Authentication FailuresHigh2 findings
1. HighDetected a Generic API Key, potentially exposing access to various services and sensitive operations.apps/cli/dist/cli.js:4019:59 code.gitleaks/generic-api-keySecurity
2. HighDetected a Generic API Key, potentially exposing access to various services and sensitive operations.apps/cli/dist/cli.js:6743:6 code.gitleaks/generic-api-keySecurity
A08Software and Data Integrity Failuresno findings
A09Security Logging and Monitoring Failuresno findings
A10Server-Side Request Forgery (SSRF)no findings

CWE Top 25 (2024)

2 of 25 with findings

#1Cross-site ScriptingCWE-79Medium1 finding
1. MediumUnescaped HTML renderingapps/site/src/scripts/catalogue.ts:50 code.security/xssSecurity
#2Out-of-bounds WriteCWE-787no findings
#3SQL InjectionCWE-89no findings
#4Cross-Site Request Forgery (CSRF)CWE-352no findings
#5Path TraversalCWE-22no findings
#6Out-of-bounds ReadCWE-125no findings
#7OS Command InjectionCWE-78no findings
#8Use After FreeCWE-416no findings
#9Missing AuthorizationCWE-862no findings
#10Unrestricted Upload of File with Dangerous TypeCWE-434no findings
#11Code InjectionCWE-94no findings
#12Improper Input ValidationCWE-20no findings
#13Command InjectionCWE-77no findings
#14Improper AuthenticationCWE-287no findings
#15Improper Privilege ManagementCWE-269no findings
#16Deserialization of Untrusted DataCWE-502no findings
#17Exposure of Sensitive Information to an Unauthorized ActorCWE-200no findings
#18Incorrect AuthorizationCWE-863no findings
#19Server-Side Request Forgery (SSRF)CWE-918no findings
#20Improper Restriction of Operations within the Bounds of a Memory BufferCWE-119no findings
#21NULL Pointer DereferenceCWE-476no findings
#22Use of Hard-coded CredentialsCWE-798High2 findings
1. HighDetected a Generic API Key, potentially exposing access to various services and sensitive operations.apps/cli/dist/cli.js:4019:59 code.gitleaks/generic-api-keySecurity
2. HighDetected a Generic API Key, potentially exposing access to various services and sensitive operations.apps/cli/dist/cli.js:6743:6 code.gitleaks/generic-api-keySecurity
#23Integer Overflow or WraparoundCWE-190no findings
#24Uncontrolled Resource ConsumptionCWE-400no findings
#25Missing Authentication for Critical FunctionCWE-306no findings

Auditors

50 auditors: 22 passed, 4 failed, 24 skipped and 0 errored. Skipped auditors give the reason, often with an install hint.

Runtime longest first, skipped at the end

22 passed4 failed0 errored24 skipped

	Engine	Categories				Notes
`code.hygiene`Repository hygiene	builtin	Best practices, Maintainability, Security	passed	0	34ms
`code.secrets`Secrets in source	builtin	Security	passed	0	261ms
`code.security`Static security analysis	builtin	Security	failed	1	167ms
`code.dependencies`Vulnerable dependencies	builtin	Supply chain, Security	passed	0	1.4s
`code.accessibility`Accessibility (static)	builtin	Accessibility	passed	0	54ms
`code.performance`Performance (static)	builtin	Performance	passed	0	202ms
`code.quality`Code quality	builtin	Maintainability, Reliability, Best practices	failed	1	163ms
`code.strictness`Language strictness config	builtin	Maintainability	passed	0	66ms
`code.api`API definition and server configuration	builtin	Security, Best practices	passed	0	166ms
`code.privacy`Privacy (code)	builtin	Privacy, Compliance	passed	0	105ms
`code.gitleaks`gitleaks secret scan	external	Security	failed	2	4.6s
`code.semgrep`Semgrep SAST	external	Security, Best practices	skipped	0	1ms	semgrep not found on PATH. Install: pipx install semgrep or brew install semgrep (https://semgrep.dev/docs/getting-started/).
`code.osv-scanner`osv-scanner dependency scan	external	Supply chain, Security	skipped	0	1ms	osv-scanner not found on PATH. Install: brew install osv-scanner or go install github.com/google/osv-scanner/v2/cmd/osv-scanner@latest.
`code.trivy-fs`Trivy filesystem scan	external	Security, Supply chain	skipped	0	0ms	trivy not found on PATH. Install: brew install trivy (https://trivy.dev/latest/getting-started/installation/).
`code.trufflehog`trufflehog secret scan	external	Security	passed	0	4.2s
`code.bandit`Bandit Python SAST	external	Security	skipped	0	1ms	bandit not found on PATH. Install: pipx install bandit or pip install bandit (https://bandit.readthedocs.io).
`code.gosec`gosec Go SAST	external	Security	skipped	0	0ms	gosec not found on PATH. Install: brew install gosec or go install github.com/securego/gosec/v2/cmd/gosec@latest.
`code.brakeman`Brakeman Rails SAST	external	Security, Supply chain	skipped	0	0ms	brakeman not found on PATH. Install: gem install brakeman or brew install brakeman (https://brakemanscanner.org).
`code.jscpd`jscpd copy-paste detection	external	Maintainability	skipped	0	1ms	jscpd not found on PATH. Install: npm install -g jscpd (https://github.com/kucherenko/jscpd#installation).
`code.pip-audit`pip-audit (Python vulnerabilities)	external	Supply chain, Security	skipped	0	1ms	pip-audit not found on PATH. Install: pipx install pip-audit (or uv tool install pip-audit).
`code.cargo-audit`cargo-audit (Rust advisories)	external	Supply chain, Security	skipped	0	1ms	cargo-audit not found on PATH. Install: cargo install cargo-audit --locked (or brew install cargo-audit).
`code.npm-audit`npm audit	external	Supply chain, Security	passed	0	1.1s
`code.pnpm-audit`pnpm audit	external	Supply chain, Security	passed	0	848ms
`code.bun-audit`bun audit	external	Supply chain, Security	passed	0	515ms
`code.scorecard`OpenSSF Scorecard	external	Supply chain	skipped	0	1ms	Set GITHUB_AUTH_TOKEN or GITHUB_TOKEN to run OpenSSF Scorecard
`code.typecheck`TypeScript type-check (tsc)	external	Reliability, Maintainability	failed	36	15.2s
`code.oxlint`oxlint	external	Maintainability, Reliability	skipped	0	1ms	oxlint not found on PATH. Install: npm install -g oxlint (https://oxc.rs/docs/guide/usage/linter).
`code.biome`Biome lint	external	Maintainability, Reliability	skipped	0	0ms	biome not found on PATH. Install: npm install -g @biomejs/biome (https://biomejs.dev/guides/getting-started/).
`code.ruff`Ruff Python lints	external	Reliability, Maintainability, Security	skipped	0	1ms	ruff not found on PATH. Install: brew install ruff or pipx install ruff (https://docs.astral.sh/ruff/installation/).
`code.staticcheck`staticcheck Go lints	external	Reliability, Maintainability	skipped	0	1ms	staticcheck not found on PATH. Install: brew install staticcheck or go install honnef.co/go/tools/cmd/staticcheck@latest.
`code.shellcheck`ShellCheck	external	Reliability, Security	skipped	0	6ms	No shell scripts in the workspace
`code.mobsfscan`mobsfscan mobile SAST	external	Security, Privacy	skipped	0	2ms	mobsfscan not found on PATH. Install: pipx install mobsfscan (also installs semgrep; https://github.com/MobSF/mobsfscan).
`code.spectral`Spectral API linting	external	Best practices, Reliability	skipped	0	1ms	spectral not found on PATH. Install: npm install -g @stoplight/spectral-cli (https://github.com/stoplightio/spectral).
`container.dockerfile`Dockerfile security & best practices	builtin	Security, Supply chain, Best practices, Performance	passed	0	14ms
`container.compose`Docker Compose security	builtin	Security, Supply chain, Reliability	passed	0	23ms
`container.image`Container image scan	external	Security, Supply chain	skipped	0	1ms	Only runs for image:<ref> targets
`container.hadolint`Hadolint	external	Best practices, Security	skipped	0	1ms	hadolint not found on PATH. Install: https://github.com/hadolint/hadolint#install
`iac.github-actions`GitHub Actions workflows	builtin	Security, Supply chain, Best practices	passed	0	43ms
`iac.zizmor`zizmor	external	Security, Supply chain	skipped	0	3ms	zizmor not found on PATH. Install: brew install zizmor, pipx install zizmor or cargo install zizmor (https://docs.zizmor.sh/installation/).
`iac.actionlint`actionlint	external	Reliability, Best practices, Security	passed	0	337ms
`iac.kubernetes`Kubernetes manifests	builtin	Security, Reliability, Supply chain	passed	0	14ms
`iac.kube-linter`kube-linter	external	Security, Reliability, Best practices	skipped	0	5ms	kube-linter not found on PATH. Install: brew install kube-linter or go install golang.stackrox.io/kube-linter/cmd/kube-linter@latest (https://docs.kubelinter.io/#/?id=installing-kubelinter).
`iac.terraform`Terraform configuration	builtin	Security	passed	0	6ms
`iac.checkov`Checkov	external	Security, Best practices	skipped	0	1ms	checkov not found on PATH. Install with `pip install checkov` or `brew install checkov`.
`mobile.android`Android app configuration	builtin	Security, Privacy, Best practices	passed	0	13ms
`mobile.ios`iOS app configuration	builtin	Security, Privacy	passed	0	16ms
`mobile.secrets`Mobile app secrets	builtin	Security	passed	0	5ms
`mobile.dependencies`Mobile dependencies	builtin	Supply chain, Security	skipped	0	0ms	Target is a source tree, not a built APK/AAB/IPA (code.dependencies covers lockfiles)
`mobile.accessibility`Mobile accessibility	builtin	Accessibility	passed	0	3ms
`mobile.performance`Mobile app size and build quality	builtin	Performance	skipped	0	1ms	Target is a source tree, not a built APK/AAB/IPA (size checks need the artifact)

Overview

Categories

Most severe findings

Coverage

Security

Evidence

Remediation

References

Evidence

Remediation

References

Evidence

Remediation

References

Accessibility

Performance

Privacy

Best practices

Reliability

Evidence

Remediation

References

Evidence

Remediation

References

Evidence

Remediation

References

Evidence

Remediation

References

Evidence

Remediation

References

Evidence

Remediation

References

Evidence

Remediation

References

Evidence

Remediation

References

Evidence

Remediation

References

Evidence

Remediation

References

Evidence

Remediation

References

Evidence

Remediation

References

Evidence

Remediation

References

Evidence

Remediation

References

Evidence

Remediation

References

Evidence

Remediation

References

Evidence

Remediation

References

Evidence

Remediation

References

Evidence

Remediation

References

Evidence

Remediation

References

Evidence